Monday, January 11, 2010

Jan 10 CVE-2009-4324 Adobe 0 Day with Backdoor:Win32/Bifrose.gen!E payload US-Taiwan Defense Industry Conference 2010 from jswang@gmail.com Sun, 10 Jan 2010 14:05:41 +0800




Download 9cc4133139cac1c774c0bf5476b2ed56 - US-Taiwan Defense Industry Conference 2010.pdf  (password protected archive, please contact me for the password)
sbcdrx.exe - 287EAC0F1F5E9223922EBFF3308F138F,
sbcdrx.dat EC8903129642D3AEF3348B68D17624B5,
SysPr.prx - 4EF40422A092B40000C1FCA20A8D8E44




Details: 9cc4133139cac1c774c0bf5476b2ed56 - US-Taiwan Defense Industry Conference 2010.pdf





The message sender was
  jswang@gmail.com
The message originating IP was 168.95.4.102 The message recipients were
  XXXXXXXXX
The message was titled US-Taiwan Defense Industry Conference 2010 The message date was Sun, 10 Jan 2010 14:05:41 +0800 The message identifier was <004b01ca91ba$f1087b90$9301a8c0@testacb8580da5>
The virus or unauthorised code identified in the email is:
Bloodhound.Exploit.288












Virustotal
http://www.virustotal.com/analisis/1962a577fac1451da67942a9860af9ff8b49648ba0cc0f801f7b1fea57022084-1263186172
File US-Taiwan_Defense_Industry_Confer received on 2010.01.11 05:02:52 (UTC)
Result: 16/41 (39.03%)
a-squared    4.5.0.48    2010.01.11    Exploit.HTML.IframeBof!IK
AntiVir    7.9.1.134    2010.01.10    HTML/Silly.Gen
Avast    4.8.1351.0    2010.01.10    JS:Pdfka-UQ
BitDefender    7.2    2010.01.11    Exploit.PDF-JS.Gen
F-Secure    9.0.15370.0    2010.01.11    Exploit.PDF-JS.Gen
GData    19    2010.01.11    Exploit.PDF-JS.Gen
Ikarus    T3.1.1.80.0    2010.01.11    Exploit.HTML.IframeBof
Kaspersky    7.0.0.125    2010.01.11    Exploit.JS.Pdfka.ayg
McAfee+Artemis    5857    2010.01.10    Exploit-PDF.bb
McAfee-GW-Edition    6.8.5    2010.01.11    Script.Silly.Gen
NOD32    4759    2010.01.10    PDF/Exploit.Gen
Norman    6.04.03    2010.01.10    HTML/Shellcode.H
PCTools    7.0.3.5    2010.01.11    HeurEngine.MaliciousExploit
Sophos    4.49.0    2010.01.11    Troj/PDFJs-GL
Symantec    20091.2.0.41    2010.01.11    Bloodhound.Exploit.288
Additional information
File size: 146896 bytes
MD5...: 9cc4133139cac1c774c0bf5476b2ed56

Wepawet
http://wepawet.cs.ucsb.edu/view.php?hash=9cc4133139cac1c774c0bf5476b2ed56&type=js
File    US-Taiwan Defense Industry Conference 2010.pdf
MD5    9cc4133139cac1c774c0bf5476b2ed56
Analysis Started    2010-01-10 21:21:45
Report Generated    2010-01-10 21:22:03
Jsand 1.03.02    benign


 Payload




Virustotal
http://www.virustotal.com/analisis/5dccc2971965f82b3f250bd84b881dcb2276583806bee3b3625840f349c60618-1263188199

File sbcdrx.exe received on 2010.01.11 05:36:39 (UTC)
Result: 17/40 (42.50%)
Compact Compact
Print results Print results
Antivirus     Version     Last Update     Result
AntiVir     7.9.1.134     2010.01.10     TR/Hijacker.Gen
Authentium     5.2.0.5     2010.01.10     W32/Heuristic-KPP!Eldorado
BitDefender     7.2     2010.01.11     Trojan.Inject.FA
CAT-QuickHeal     10.00     2010.01.11     (Suspicious) - DNAScan
F-Prot     4.5.1.85     2010.01.10     W32/Heuristic-KPP!Eldorado
F-Secure     9.0.15370.0     2010.01.11     Trojan.Inject.FA
GData     19     2010.01.11     Trojan.Inject.FA
Kaspersky     7.0.0.125     2010.01.11     Heur.Backdoor.Generic
Microsoft     1.5302     2010.01.10     Backdoor:Win32/Bifrose.gen!E
Panda     10.0.2.2     2010.01.10     Suspicious file
Rising     22.30.00.01     2010.01.11     Packer.Win32.UnkPacker.d
Symantec     20091.2.0.41     2010.01.11     Suspicious.Cloud
TrendMicro     9.120.0.1004     2010.01.11     PAK_Generic.001
VBA32     3.12.12.1     2010.01.11     Backdoor.Win32.Bifrose.btqt

Additional information
File size: 92413 bytes
MD5   : 287eac0f1f5e9223922ebff3308f138f

 Anubis report on sbcdrx.exe

http://anubis.iseclab.org/?action=result&task_id=160bfa952bdd44db4b958119803b41281&format=html#id395670


- Files Created:

C:\DOCUME~1\ADMINI~1\LOCALS~1\sbcdrx.dat


- Files Read:

C:\sbcdrx.exe


- Files Modified:

C:\DOCUME~1\ADMINI~1\LOCALS~1\sbcdrx.datinfo


- Files Renamed:

Old Filename
New Filename
C:\sbcdrx.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\sbcdrx.exe




sbcdrx.exe - Process Activities


- Remote Threads Created:

Affected Process
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\explorer.exe



- Foreign Memory Regions Written:

Process: C:\Program Files\Messenger\msmsgs.exe
Process: C:\WINDOWS\explorer.exe

3. msmsgs.exe


- General information about this executable

Analysis Reason:
sbcdrx.exe wrote to the virtual memory of this process 
Filename:
msmsgs.exe 
Command Line:
"C:\Program Files\Messenger\msmsgs.exe" /background 

a) msmsgs.exe - Registry Activities


- Registry Keys Created:

HKLM\​SYSTEM\​CurrentControlSet\​Control\​MediaResources\​msvideo

msmsgs.exe - Network Activity


-  Unknown TCP Traffic:

from ANUBIS:1038 to 60.250.199.105:443
State: Connection established, not terminated - Transferred outbound Bytes: 159 - Transferred inbound Bytes: 97


60.250.199.105
Hostname: 60-250-199-105.hinet-ip.hinet.net
ISP: CHTD, Chunghwa Telecom Co., Ltd. Organization: Chunghwa Telecom Data Communication Business Group City: Taipei
Country:Taiwan

Text of the pdf file

2009 International Workshop of
Differential Equations and their
Applications
Da Hsuan Feng
Senior Executive Vice President Interim Vice President for Research and
Development
National Cheng Kung University
I was asked by the organizers of this Workshop, my colleague Professor
Yung-fu Fang (方永富) to say a few words of welcome here.
The Workshop with the aforementioned title, is organized by NCKU’s
Department of Mathematics from the College of Science, National Center
for Theoretical Sciences (South) and a colleague, Professor Yuusuke Iso
(磯祐介) from Kyoto University’s Dept. of Applied Analysis and
Complex Dynamical Systems.
I am sure I was bestowed this great honor only because of my
administrative title, since I am transparently neither a mathematician nor
an applied mathematician. Still, I am a firm believer that if NCKU were to
achieve prominence as a comprehensive university, having an
intellectually robust mathematics and applied mathematics program
matters and it is non-negotiable! For this reason, I am very pleased to see
this Workshop is held here on campus.
Ladies and gentlemen, whenever I think about mathematics, I am always
amused by a lighter moment of my life. When my daughter was in high
school, she played the violin. In one of her performances, the orchestra
which accompanied her included an older gentleman in the first violin
section. I later found out that this older gentleman is a great
mathematician, and his name is Eugenio Calabi, who developed, I am
sure you know far more than I do, the so-called Calabi-Yau (丘成桐)
manifolds. So, in a sense, while I did not have the opportunity to listen to
Calabi talking about mathematics, I did hear him playing the violin!
Actually, to me, that is not too regrettable. After all, for me, listening to a
mathematics talk is like listening to an Italian opera: It’s beautiful and I
don’t understand a word of it.
To our distinguished visitors from abroad and domestic, I like to welcome
all of you to sunny Tainan. I like to especially say a special hello to
Professor Iso and all your colleagues from Kyoto University. I should let
you know that because of our structural, intellectual and historical
similarities, NCKU considers your university our “benchmark.” We hope
that NCKU can enter into a deeper and more sustainable relation with
your university so that we can learn more from you.
Since this is a Workshop about differential equations and applications, I
cannot help myself to mention one of the first, if not the first of such an
effort, and what a glorious effort it was. I am sure you can guess which
effort I am referring to. It was the “creation” of the differential
equations by James Clark Maxwell, whose name sake equations
fundamentally and totally explained electromagnetic radiations.
Of course, even for Maxwell equations, there were skeptics, as I am sure
you will find yours in your work. Maxwell’s “critic,” if you can call him
that, was the great Michael Faraday. He wrote the following critique
about Maxwell equations:
“The attention of two very able men and eminent mathematicians (Lord
Kelvin and Sir James Clark Maxwell) has fallen upon my proposition to
represent the magnetic force; and it is to me a source of great
gratification and much encouragement to find that they affirm the
truthfulness and generality of the method of representation.”
This is obviously one of the most elegant ways of saying “I find it hard
to believe that these equations can represent the complex phenomena so
well!” To criticize with such elegance is truly an art that is no longer
present today!
Mathematics and applied mathematics are intellectually ubiquitous. This
is made abundantly clear in the range of topics covered in this Workshop.
In 2005, I attended a conference in Mexico whose main topic was to
apply differential geometry and low dimensional topology (or knots
theory) to unravel the DNA structures. It was truly an eye-opening event
for me, because at the meeting, I saw biological scientists discussing
intensely with applied and pure mathematicians.
During my professional career, which included my dabbling into
mathematical physics, I have always marveled and was, and still am,
deeply impressed that for a mathematician, a sphere is a coset space called
SU(2)/U(1) and a plane is a coset space of H(4)/U(1). Such mathematical
characterizations, and indeed their generalizations, have unlocked the
doors for mathematicians to travel into the deepest areas of human
thoughts. These coset spaces, for example, may be an opportunity for
physicists to apply them to study the “quantum phase space,” a concept
which is important in understanding the elusive “quantum chaos.” Ever
since, I knew that never a mathematician could I be. I learned this many
years ago such intricacies from my former student and now an excellent
NCKU distinguished theoretical physics professor Wei-Min Zhang (張為
民.)
Still, maybe because of my limited knowledge of mathematics, I have
always enjoyed listening to great mathematicians speak (opera singing
notwithstanding.) In fact, on May 23
rd
, 1989 in Philadelphia, I was
privileged to invite the great late-Chern to talk on “What is Geometry.” I
should mention that the great late-Chern (陳省身) had a “non-linear
connection” to NCKU in that his son-in-law, Paul Chu (朱經武,) is a
NCKU distinguished alumnus. Paul who for nearly the entire first
decade of the 21st century, was the president of Hong Kong University of
Science and Technology and is of course a globally known scientist;
among his many scientific achievements included the co-discovery of
high temperature superconductivity!
Nevertheless, “armed” with that small and dangerous (and I am sure you
would call insignificant) knowledge of mathematics, it has given me a
deep belief as a university administrator that an irreducible component of
an institution of higher learning must absolutely be that it has outstanding
mathematics and applied mathematics intellectual efforts if it were to
reach the highest level of excellence. It is for this reason that I am so
enthusiastic about your Workshop.
I hope you reach your goal in this Workshop.
For the foreign guests, I hope you have an enjoyable time in Tainan.
Thank you for your attention.

No comments:

Post a Comment